From ed1d1f519c56c6c2ffa13f3d52cd77beb023db13 Mon Sep 17 00:00:00 2001 From: Alexis Savery Date: Thu, 30 Jul 2026 13:42:40 -0700 Subject: [PATCH] platform/chrome: lightbar: Limit payload to max packet size The LIGHTBAR_CMD_SET_PROGRAM command uses an 8-bit size field for its payload length, but the protocol-negotiated `max_request` may exceed the maximum value an 8-bit integer can represent. When this occurs, large payloads (e.g., >255 bytes) integer wrap the 8-bit size variable when assigning `param->set_program_ex.size`, causing truncation and parse failures downstream in the EC firmware stack. Clamp `max_size` to the maximum value the structural size field can support. Fixes: 9600b8bdbfe4 ("platform/chrome: lightbar: Add support for large sequence") Signed-off-by: Alexis Savery Link: https://lore.kernel.org/r/20260730204240.2227178-1-asavery@google.com Signed-off-by: Tzung-Bi Shih --- drivers/platform/chrome/cros_ec_lightbar.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/platform/chrome/cros_ec_lightbar.c b/drivers/platform/chrome/cros_ec_lightbar.c index d7e9928e263d..f70076c9d037 100644 --- a/drivers/platform/chrome/cros_ec_lightbar.c +++ b/drivers/platform/chrome/cros_ec_lightbar.c @@ -505,9 +505,14 @@ static ssize_t program_store(struct device *dev, struct device_attribute *attr, return -EINVAL; } } else { + /* + * Bound the payload strictly by the maximum value the structural + * size field can natively support. + */ extra_bytes = offsetof(typeof(*param), set_program_ex) + sizeof(param->set_program_ex); - max_size = ec->ec_dev->max_request - extra_bytes; + max_size = min_t(size_t, ec->ec_dev->max_request - extra_bytes, + type_max(typeof(param->set_program_ex.size))); } msg = alloc_lightbar_cmd_msg(ec);